Spring Security Articles
Articles on Spring Security authentication, authorization, HTTP security, JWT, and method-level security.
-
Which Spring Boot Authentication Method Should You Choose? Comparing Session, JWT, OAuth2, and API Key with a Selection Flowchart
Compare Spring Boot authentication methods (Session, JWT, OAuth2, API Key) by application architecture. Use the selection flowchart and comparison table to decide which method fits your app, then move from a minimal SecurityFilterChain configuration to each implementation guide.
-
How to Implement Session Management with Spring Session + Redis in Spring Boot - Sharing Sessions Across Multiple Instances
An implementation guide to solving the problem of login state being lost when scaling out a Spring Boot app to multiple instances, using Spring Session + Redis. Covers everything end to end: adding dependencies, configuring spring.session.*, cookie design, Spring Security integration, debugging with redis-cli, and verifying behavior across two instances.
-
Implementing Database Authentication with Spring Security - Persisting Users with UserDetailsService and JdbcUserDetailsManager
This article explains the standard pattern for moving away from in-memory users and authenticating against users stored in your own users table. It covers, with code, how to write your own UserDetailsService, wire it into DaoAuthenticationProvider, use JdbcUserDetailsManager with the standard schema, register and verify passwords with BCrypt, and handle account disabling.
-
How to Implement JWT Refresh Tokens with Spring Security
A guide to issuing, rotating, and revoking access tokens and refresh tokens in Spring Boot, including Redis persistence and reuse detection.
-
Understanding Spring Security CSRF Protection Correctly - Configuration Differences Between REST APIs and Web Apps
Solve the cause of POST returning 403 in Spring Security by understanding the CSRF mechanism. From why `csrf().disable()` is correct for REST APIs, the required settings for Thymeleaf forms, to AJAX support via `CookieCsrfTokenRepository.withHttpOnlyFalse()`, organized with Spring Security 6 Lambda DSL implementation examples.
-
How to Configure Spring Boot as an OAuth2 Resource Server - Implementing JWT Validation and Scope-Based Authorization
A guide to validating JWTs issued by external IdPs such as Keycloak, Cognito, and Auth0 using Spring Security's resource server features, and implementing scope- and claim-based authorization.
-
How to Use GraphQL with Spring Boot - Spring for GraphQL Basics and When to Use It vs REST API
Using Spring for GraphQL in Spring Boot 3.x, this guide covers schema definition, Query and Mutation Resolver implementation, handling N+1 problems with DataLoader, and integration with Spring Security. Includes a comparison with REST API to clarify when to choose GraphQL.
-
Spring Security Method Security - How to Implement RBAC with @PreAuthorize
A guide to implementing method-level Role-Based Access Control (RBAC) in Spring Boot using @PreAuthorize/@PostAuthorize/@Secured. Learn how to enable @EnableMethodSecurity, the differences between hasRole/hasAuthority, owner checks with SpEL, and testing with @WithMockUser, all with code examples.
-
How to Implement Real-Time Communication with WebSocket in Spring Boot - STOMP and SockJS Basics
A step-by-step guide to getting a broadcast-style chat running quickly with Spring Boot + STOMP + SockJS, explained through a three-layer structure: the configuration class, @MessageMapping, and SimpMessagingTemplate. Also covers one-to-one messaging, retrieving the authenticated user via Principal, and scaling with an external broker.
-
How to Configure CORS in Spring Boot - Choosing Between @CrossOrigin and WebMvcConfigurer
A practical guide to resolving CORS errors when calling a Spring Boot REST API from frontends like React or Vue. Covers when to use each of the three approaches (@CrossOrigin, WebMvcConfigurer, and SecurityFilterChain), plus the pitfalls to watch for when introducing Spring Security.
-
Server-Side Rendering with Thymeleaf in Spring Boot: A Complete Guide to Forms, Validation, and Security Integration
A hands-on tutorial covering Spring Boot 3.x and Thymeleaf 3.1 end to end: HTML responses, form handling, Bean Validation error display, and Spring Security integration (CSRF and auth-aware view switching). Built around runnable code examples you can use as-is.
-
Spring Boot 2.x to 3.x Migration Guide - Java 17 Required with Checklist
Explains the 2.x→3.x migration steps with practical code examples in response to Spring Boot 2.7 end-of-life (EOL) and the Java 17 requirement. Organizes javax→jakarta replacement, SecurityFilterChain migration, and spring.factories deprecation handling with a checklist, providing the shortest route to understanding the causes and solutions for compilation/startup errors.
-
How to Implement Google Login (OAuth2) with Spring Boot
A step-by-step guide to implementing Google social login from scratch using Spring Security OAuth2 Client. Covers everything from how the OAuth2 authorization code flow works to application.yml configuration and UserInfo retrieval, while building an app that runs in a local environment.
-
Spring Boot JWT Authentication with Spring Security (Tutorial)
Build JWT authentication for a Spring Boot REST API from scratch. Covers token generation, validation, JwtAuthenticationFilter, and SecurityFilterChain configuration with complete code examples.
-
Getting Started with Authentication in Spring Boot Using Spring Security - From Basic Auth to Form Login
A beginner-friendly tutorial for implementing authentication step by step with Spring Security in Spring Boot. Covers SecurityFilterChain fundamentals, the BCrypt password encoder, Basic authentication (verified with curl), form login, logout, and custom login pages, with careful explanations of the configuration points where beginners commonly get stuck.